Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 18:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe
-
Size
56KB
-
MD5
ac58ac746bbade95e8979dcd0b8bf410
-
SHA1
6c8c7a24a146f3e2e131ecbda6662cfa0dd90e94
-
SHA256
6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46
-
SHA512
e4a8507f01944dd5a7a9687debcf267382efdfabebe999b51a941ff3849fdaeccf87f8222be7df7be4732faf54af7c6941d765b6022a90ce786a2fd73133a0d2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgEb:ymb3NkkiQ3mdBjFI3Eb
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
resource yara_rule behavioral1/memory/2748-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/484-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/588-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2520-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/888-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1676-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1356-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2796-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2876 pjvvd.exe 2640 fllxxfx.exe 2620 nbthhb.exe 3052 dvppj.exe 484 5fxxrlr.exe 588 hnbnbn.exe 2272 pjvjj.exe 2560 llflrxl.exe 1736 thnbbh.exe 2520 thbthh.exe 2792 vjjjd.exe 3024 lxxrxxf.exe 2480 3flrxxx.exe 1532 tnnbhb.exe 1404 dvpvd.exe 2340 fxrlxlf.exe 1940 rffffxf.exe 888 nhtbbb.exe 1932 1jvpv.exe 1676 1xlrrrx.exe 2584 rlrrxxl.exe 2424 ttthht.exe 2016 hbnhhh.exe 1068 vjpjj.exe 1356 1rxxxxx.exe 1636 rlrxfrr.exe 992 hbhnnb.exe 916 7tbtnh.exe 892 pjvvd.exe 2540 7lxfffl.exe 2796 vjpdd.exe 2908 7pddj.exe 2704 9rxrlll.exe 2628 1lxrxxf.exe 2692 btnthh.exe 2456 httttn.exe 784 pdvvp.exe 1048 3dppv.exe 320 1lflrxf.exe 820 frxxxfx.exe 2132 nhbntt.exe 768 hbtbbn.exe 2080 bttttn.exe 2460 pdjdd.exe 316 1pdvv.exe 2520 lfrrrxf.exe 2676 1lxrrrf.exe 2508 9rfxrrl.exe 568 bhnbbn.exe 1260 btnhtt.exe 1288 jjvdj.exe 2256 vppdj.exe 2208 5fxflrf.exe 3020 3hbbnn.exe 2308 3ttbth.exe 1952 vpjpv.exe 2476 pdvdj.exe 1348 7pjdd.exe 2584 ffrrfrf.exe 2372 xxxlrll.exe 1516 nhhntt.exe 1788 5jddj.exe 308 jjpvv.exe 2072 xxxxrrl.exe -
resource yara_rule behavioral1/memory/2748-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2876-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/484-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/588-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2520-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/888-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1676-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1356-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2796-310-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 2876 2748 6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe 30 PID 2748 wrote to memory of 2876 2748 6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe 30 PID 2748 wrote to memory of 2876 2748 6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe 30 PID 2748 wrote to memory of 2876 2748 6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe 30 PID 2876 wrote to memory of 2640 2876 pjvvd.exe 31 PID 2876 wrote to memory of 2640 2876 pjvvd.exe 31 PID 2876 wrote to memory of 2640 2876 pjvvd.exe 31 PID 2876 wrote to memory of 2640 2876 pjvvd.exe 31 PID 2640 wrote to memory of 2620 2640 fllxxfx.exe 32 PID 2640 wrote to memory of 2620 2640 fllxxfx.exe 32 PID 2640 wrote to memory of 2620 2640 fllxxfx.exe 32 PID 2640 wrote to memory of 2620 2640 fllxxfx.exe 32 PID 2620 wrote to memory of 3052 2620 nbthhb.exe 33 PID 2620 wrote to memory of 3052 2620 nbthhb.exe 33 PID 2620 wrote to memory of 3052 2620 nbthhb.exe 33 PID 2620 wrote to memory of 3052 2620 nbthhb.exe 33 PID 3052 wrote to memory of 484 3052 dvppj.exe 34 PID 3052 wrote to memory of 484 3052 dvppj.exe 34 PID 3052 wrote to memory of 484 3052 dvppj.exe 34 PID 3052 wrote to memory of 484 3052 dvppj.exe 34 PID 484 wrote to memory of 588 484 5fxxrlr.exe 35 PID 484 wrote to memory of 588 484 5fxxrlr.exe 35 PID 484 wrote to memory of 588 484 5fxxrlr.exe 35 PID 484 wrote to memory of 588 484 5fxxrlr.exe 35 PID 588 wrote to memory of 2272 588 hnbnbn.exe 36 PID 588 wrote to memory of 2272 588 hnbnbn.exe 36 PID 588 wrote to memory of 2272 588 hnbnbn.exe 36 PID 588 wrote to memory of 2272 588 hnbnbn.exe 36 PID 2272 wrote to memory of 2560 2272 pjvjj.exe 37 PID 2272 wrote to memory of 2560 2272 pjvjj.exe 37 PID 2272 wrote to memory of 2560 2272 pjvjj.exe 37 PID 2272 wrote to memory of 2560 2272 pjvjj.exe 37 PID 2560 wrote to memory of 1736 2560 llflrxl.exe 38 PID 2560 wrote to memory of 1736 2560 llflrxl.exe 38 PID 2560 wrote to memory of 1736 2560 llflrxl.exe 38 PID 2560 wrote to memory of 1736 2560 llflrxl.exe 38 PID 1736 wrote to memory of 2520 1736 thnbbh.exe 39 PID 1736 wrote to memory of 2520 1736 thnbbh.exe 39 PID 1736 wrote to memory of 2520 1736 thnbbh.exe 39 PID 1736 wrote to memory of 2520 1736 thnbbh.exe 39 PID 2520 wrote to memory of 2792 2520 thbthh.exe 40 PID 2520 wrote to memory of 2792 2520 thbthh.exe 40 PID 2520 wrote to memory of 2792 2520 thbthh.exe 40 PID 2520 wrote to memory of 2792 2520 thbthh.exe 40 PID 2792 wrote to memory of 3024 2792 vjjjd.exe 41 PID 2792 wrote to memory of 3024 2792 vjjjd.exe 41 PID 2792 wrote to memory of 3024 2792 vjjjd.exe 41 PID 2792 wrote to memory of 3024 2792 vjjjd.exe 41 PID 3024 wrote to memory of 2480 3024 lxxrxxf.exe 42 PID 3024 wrote to memory of 2480 3024 lxxrxxf.exe 42 PID 3024 wrote to memory of 2480 3024 lxxrxxf.exe 42 PID 3024 wrote to memory of 2480 3024 lxxrxxf.exe 42 PID 2480 wrote to memory of 1532 2480 3flrxxx.exe 43 PID 2480 wrote to memory of 1532 2480 3flrxxx.exe 43 PID 2480 wrote to memory of 1532 2480 3flrxxx.exe 43 PID 2480 wrote to memory of 1532 2480 3flrxxx.exe 43 PID 1532 wrote to memory of 1404 1532 tnnbhb.exe 44 PID 1532 wrote to memory of 1404 1532 tnnbhb.exe 44 PID 1532 wrote to memory of 1404 1532 tnnbhb.exe 44 PID 1532 wrote to memory of 1404 1532 tnnbhb.exe 44 PID 1404 wrote to memory of 2340 1404 dvpvd.exe 45 PID 1404 wrote to memory of 2340 1404 dvpvd.exe 45 PID 1404 wrote to memory of 2340 1404 dvpvd.exe 45 PID 1404 wrote to memory of 2340 1404 dvpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe"C:\Users\Admin\AppData\Local\Temp\6d72c4f0c54a5d6eeadea9460b495234ac5effe1cd3b281575eafe77dd98fe46N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pjvvd.exec:\pjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fllxxfx.exec:\fllxxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nbthhb.exec:\nbthhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvppj.exec:\dvppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\5fxxrlr.exec:\5fxxrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\hnbnbn.exec:\hnbnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\pjvjj.exec:\pjvjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\llflrxl.exec:\llflrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\thnbbh.exec:\thnbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\thbthh.exec:\thbthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vjjjd.exec:\vjjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lxxrxxf.exec:\lxxrxxf.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\3flrxxx.exec:\3flrxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\tnnbhb.exec:\tnnbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\dvpvd.exec:\dvpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\fxrlxlf.exec:\fxrlxlf.exe17⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rffffxf.exec:\rffffxf.exe18⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhtbbb.exec:\nhtbbb.exe19⤵
- Executes dropped EXE
PID:888 -
\??\c:\1jvpv.exec:\1jvpv.exe20⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1xlrrrx.exec:\1xlrrrx.exe21⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ttthht.exec:\ttthht.exe23⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hbnhhh.exec:\hbnhhh.exe24⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vjpjj.exec:\vjpjj.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rlrxfrr.exec:\rlrxfrr.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hbhnnb.exec:\hbhnnb.exe28⤵
- Executes dropped EXE
PID:992 -
\??\c:\7tbtnh.exec:\7tbtnh.exe29⤵
- Executes dropped EXE
PID:916 -
\??\c:\pjvvd.exec:\pjvvd.exe30⤵
- Executes dropped EXE
PID:892 -
\??\c:\7lxfffl.exec:\7lxfffl.exe31⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjpdd.exec:\vjpdd.exe32⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7pddj.exec:\7pddj.exe33⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9rxrlll.exec:\9rxrlll.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1lxrxxf.exec:\1lxrxxf.exe35⤵
- Executes dropped EXE
PID:2628 -
\??\c:\btnthh.exec:\btnthh.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\httttn.exec:\httttn.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pdvvp.exec:\pdvvp.exe38⤵
- Executes dropped EXE
PID:784 -
\??\c:\3dppv.exec:\3dppv.exe39⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1lflrxf.exec:\1lflrxf.exe40⤵
- Executes dropped EXE
PID:320 -
\??\c:\frxxxfx.exec:\frxxxfx.exe41⤵
- Executes dropped EXE
PID:820 -
\??\c:\nhbntt.exec:\nhbntt.exe42⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbtbbn.exec:\hbtbbn.exe43⤵
- Executes dropped EXE
PID:768 -
\??\c:\bttttn.exec:\bttttn.exe44⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pdjdd.exec:\pdjdd.exe45⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1pdvv.exec:\1pdvv.exe46⤵
- Executes dropped EXE
PID:316 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe47⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1lxrrrf.exec:\1lxrrrf.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9rfxrrl.exec:\9rfxrrl.exe49⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bhnbbn.exec:\bhnbbn.exe50⤵
- Executes dropped EXE
PID:568 -
\??\c:\btnhtt.exec:\btnhtt.exe51⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jjvdj.exec:\jjvdj.exe52⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vppdj.exec:\vppdj.exe53⤵
- Executes dropped EXE
PID:2256 -
\??\c:\5fxflrf.exec:\5fxflrf.exe54⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3hbbnn.exec:\3hbbnn.exe55⤵
- Executes dropped EXE
PID:3020 -
\??\c:\3ttbth.exec:\3ttbth.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpjpv.exec:\vpjpv.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pdvdj.exec:\pdvdj.exe58⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7pjdd.exec:\7pjdd.exe59⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ffrrfrf.exec:\ffrrfrf.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\xxxlrll.exec:\xxxlrll.exe61⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhhntt.exec:\nhhntt.exe62⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5jddj.exec:\5jddj.exe63⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jjpvv.exec:\jjpvv.exe64⤵
- Executes dropped EXE
PID:308 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe65⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3lffffr.exec:\3lffffr.exe66⤵PID:2180
-
\??\c:\3llxrrx.exec:\3llxrrx.exe67⤵PID:2696
-
\??\c:\thnthb.exec:\thnthb.exe68⤵PID:2452
-
\??\c:\dvppv.exec:\dvppv.exe69⤵PID:1512
-
\??\c:\jjvjd.exec:\jjvjd.exe70⤵PID:2864
-
\??\c:\7xrrrxl.exec:\7xrrrxl.exe71⤵PID:2948
-
\??\c:\7rlxxfl.exec:\7rlxxfl.exe72⤵PID:1728
-
\??\c:\3thhtt.exec:\3thhtt.exe73⤵PID:2644
-
\??\c:\htbhhh.exec:\htbhhh.exe74⤵PID:2876
-
\??\c:\dpddd.exec:\dpddd.exe75⤵PID:2640
-
\??\c:\7jpjv.exec:\7jpjv.exe76⤵PID:2612
-
\??\c:\flfxffl.exec:\flfxffl.exe77⤵PID:1796
-
\??\c:\rlfflrx.exec:\rlfflrx.exe78⤵PID:780
-
\??\c:\fllffrr.exec:\fllffrr.exe79⤵PID:3048
-
\??\c:\5bnntn.exec:\5bnntn.exe80⤵PID:1964
-
\??\c:\5hbttn.exec:\5hbttn.exe81⤵PID:484
-
\??\c:\vjdpj.exec:\vjdpj.exe82⤵PID:2012
-
\??\c:\vvvpd.exec:\vvvpd.exe83⤵PID:2132
-
\??\c:\5jjpp.exec:\5jjpp.exe84⤵PID:768
-
\??\c:\fxfflrx.exec:\fxfflrx.exe85⤵PID:3056
-
\??\c:\5xrfflr.exec:\5xrfflr.exe86⤵PID:2824
-
\??\c:\bbntnn.exec:\bbntnn.exe87⤵PID:2812
-
\??\c:\1ttnnn.exec:\1ttnnn.exe88⤵PID:2520
-
\??\c:\ppjdd.exec:\ppjdd.exe89⤵PID:2056
-
\??\c:\5dpjj.exec:\5dpjj.exe90⤵PID:2480
-
\??\c:\xxxrllf.exec:\xxxrllf.exe91⤵PID:1740
-
\??\c:\xxlrxrx.exec:\xxlrxrx.exe92⤵PID:1440
-
\??\c:\rlfrrxf.exec:\rlfrrxf.exe93⤵PID:1060
-
\??\c:\bbhntb.exec:\bbhntb.exe94⤵PID:2256
-
\??\c:\9nhtbb.exec:\9nhtbb.exe95⤵PID:2512
-
\??\c:\1pvvd.exec:\1pvvd.exe96⤵PID:2972
-
\??\c:\vjjjj.exec:\vjjjj.exe97⤵PID:1436
-
\??\c:\lffflll.exec:\lffflll.exe98⤵PID:1628
-
\??\c:\frflrxl.exec:\frflrxl.exe99⤵PID:2004
-
\??\c:\bthhtt.exec:\bthhtt.exe100⤵PID:1160
-
\??\c:\nhttnn.exec:\nhttnn.exe101⤵PID:2384
-
\??\c:\vpdjj.exec:\vpdjj.exe102⤵PID:2144
-
\??\c:\pjdjj.exec:\pjdjj.exe103⤵PID:1556
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe104⤵PID:2000
-
\??\c:\lxxxllr.exec:\lxxxllr.exe105⤵PID:2432
-
\??\c:\lxflrrr.exec:\lxflrrr.exe106⤵PID:2548
-
\??\c:\7nntnn.exec:\7nntnn.exe107⤵PID:2204
-
\??\c:\nhhttb.exec:\nhhttb.exe108⤵PID:1036
-
\??\c:\1jjpv.exec:\1jjpv.exe109⤵PID:2800
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe110⤵PID:2300
-
\??\c:\3xffrxl.exec:\3xffrxl.exe111⤵PID:2540
-
\??\c:\btbbhh.exec:\btbbhh.exe112⤵PID:2568
-
\??\c:\3hthth.exec:\3hthth.exe113⤵PID:2788
-
\??\c:\ntnntb.exec:\ntnntb.exe114⤵
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\vpvdd.exec:\vpvdd.exe115⤵PID:2636
-
\??\c:\vvddp.exec:\vvddp.exe116⤵PID:2668
-
\??\c:\xlxxlfr.exec:\xlxxlfr.exe117⤵PID:536
-
\??\c:\3frrxxl.exec:\3frrxxl.exe118⤵PID:880
-
\??\c:\9bthnt.exec:\9bthnt.exe119⤵PID:580
-
\??\c:\9tttbt.exec:\9tttbt.exe120⤵PID:1868
-
\??\c:\hbnnnn.exec:\hbnnnn.exe121⤵PID:2088
-
\??\c:\vjpvd.exec:\vjpvd.exe122⤵PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-